{"id":"CVE-2026-120204","kind":"vulnerability","aliases":["CVE-2026-120204"],"related":[],"title":"DeepInfer: unauthenticated /profile endpoint lets remote users create arbitrary directories","description":"DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.","summary":"DeepInfer through 0.1.0 has an unauthenticated /profile endpoint whose output_dir parameter is not restricted, so remote attackers can create directories anywhere the process can write. Attackers can also fill the disk or inodes with trace files and use error messages to map the filesystem.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"deepinfer","fixed":[],"affected":"<= 0.1.0","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-inference","ai-tooling","deepinfer","opt-in-endpoint","python"],"not_affected_if":["default-config","endpoint-not-exposed"],"how_to_check":"- Check whether the profiling server is enabled: look for DEEPINFER_PROFILE_HTTP_ENABLE=1 in the environment of your DeepInfer engine processes. Per the code it is off by default.\n- If enabled, it listens on DEEPINFER_PROFILE_HTTP_PORT_BASE + GPU id (default base 6070 per a third-party write-up); check with 'ss -ltnp' whether those ports are reachable beyond localhost.\n- Installed version: 'pip show deepinfer' (not confirmed whether the package is on PyPI; the project is built from source via build.sh).","fix":null,"status":"open","published_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:40:35+00:00","updated_at":"2026-10-31T18:42:11+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-31T18:40:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"DeepInfer: unauthenticated /profile endpoint lets remote users create arbitrary directories","impact":"medium","summary":"DeepInfer through 0.1.0 has an unauthenticated /profile endpoint whose output_dir parameter is not restricted, so remote attackers can create directories anywhere the process can write. Attackers can also fill the disk or inodes with trace files and use error messages to map the filesystem.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["deepinfer","python","ai-inference"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Disk or inodes exhausted; filesystem layout exposed via error messages","analyst_note":"Confirm the fixed version and whether any patch exists, since the sources state neither; the NVD entry is the only source.","how_to_check":"- Check whether DeepInfer is installed and which version: `pip show deepinfer` (version string unknown from sources)\n- Check whether the /profile endpoint is reachable from outside the network\n- unknown whether the sources give a specific command for this check","plain_action":"","needs_analyst":true,"not_affected_if":["endpoint-not-exposed"],"who_is_affected":"Teams running DeepInfer 0.1.0 or earlier with the /profile endpoint reachable over a network, including from an operator's browser through cross-site requests. The sources do not describe a specific configuration that limits exposure. Teams not running DeepInfer can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4157,"output_tokens":576,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether any patch exists, since the sources state neither; the NVD entry is the only source.","search":"'-120204':13A,16A '-2026':12A,15A '/profile':3A,36B,86C '0.1.0':32B,77C 'ai':19B,22B 'ai-infer':18B 'ai-tool':21B 'allow':89C 'also':58B 'anywher':51B 'arbitrari':9A,94C 'attack':47B,56B,91C,101C 'browser':112C 'chrome':115C 'contain':78C 'creat':8A,49B,93C 'cross':104C 'cross-sit':103C 'cve':11A,14A 'deepinf':1A,24B,30B,75C 'deepinfer':17A 'dir':40B,99C 'directori':10A,50B,95C 'disk':61B,120C 'endpoint':4A,28B,37B,87C 'error':69B,125C 'exhaust':119C 'file':66B,117C 'filesystem':74B,129C 'fill':59B 'get':106C 'includ':102C 'infer':20B 'inod':63B,122C 'let':5A 'map':72B 'messag':70B,126C 'oper':110C 'opt':26B 'opt-in-endpoint':25B 'oracl':130C 'output':39B,98C 'paramet':41B,100C 'path':80C 'process':53B 'python':29B 'remot':6A,46B,90C 'request':107C 'restrict':44B 'site':105C 'tool':23B 'trace':65B,116C 'travers':81C 'unauthent':2A,35B,85C 'use':68B,124C 'user':7A 'via':96C 'vulner':82C 'whose':38B 'write':55B,114C","nicknames":[],"mitigations":[],"who_affected":"Anyone running DeepInfer (deepseek-ai/DeepInfer) 0.1.0 or earlier with the optional profiling HTTP server turned on (DEEPINFER_PROFILE_HTTP_ENABLE=1), which per the code is off by default. If it is reachable over a network, or from an operator's browser via cross-site GET, someone can make the engine create directories and write trace files wherever the process can write. Setups without the profiling server enabled can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120204","severity":null,"published_at":"2026-10-31T18:17:08+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120204:1256","url":null,"severity":null,"published_at":"2026-10-31T18:42:11+00:00","modified_at":"2026-10-31T18:42:11+00:00","first_seen_at":"2026-10-31T18:42:11+00:00","fetched_at":"2026-10-31T18:42:11+00:00","note":"No vendor advisory or release found; repo has no releases, fix unconfirmed. Open unmerged community PR #242 hardens the profile server (not linked to CVE by any source). Profile server is off by default (DEEPINFER_PROFILE_HTTP_ENABLE=1), per third-party source mirror/blog, not vendor docs. Nothing marked verified."}],"documents":[{"id":34324,"url":"https://github.com/deepseek-ai/DeepInfer","title":"deepseek-ai/DeepInfer repository (README, no releases, no advisories)","kind":"vendor","source":"analyst","publisher":null,"text":"Repository checked 2026-10-31: 5 commits, latest Oct 25 2026; no releases published (github.com/deepseek-ai/DeepInfer/releases says none). Open-source release, offline inference.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":34326,"url":"https://github.com/deepseek-ai/DeepInfer/pulls","title":"DeepInfer open PRs incl. #242 harden profiling HTTP server (unmerged)","kind":"issue","source":"analyst","publisher":null,"text":"Open PR list on 2026-10-31 shows #242 'fix: harden the profiling HTTP server against forged and out-of-tree requests' opened Oct 27 2026 by contributor lhy027, still open (not merged). Page does not link it to the CVE.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":34328,"url":"https://inf.latent.space/file/deepinfer/engine/profile_server.py","title":"DeepInfer profile_server.py annotated source (third-party mirror)","kind":"other","source":"analyst","publisher":null,"text":"Third-party annotated copy of deepinfer/engine/profile_server.py: per-engine HTTP profiling endpoint, listens on DEEPINFER_PROFILE_HTTP_PORT_BASE + driver_gpu_id, off by default, enabled with DEEPINFER_PROFILE_HTTP_ENABLE=1. A third-party blog (pinghaoyang.com.cn) gives default base port 6070 and says the code also accepts GET.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}